Starstruk Logo MarkStarstruk

v1.2.2-stable

gtsteffaniak/filebrowserv1.2.2-stableMar 7, 2026by gtsteffaniak

AI Summary

This release patches two security vulnerabilities (Stored XSS and password-protected share bypass) and introduces UI improvements including a divider option for sidebar links and a 'go to source location' feature for shares. Bug fixes address database path loading and zipped directory download errors for scoped users.

Key Highlights

  • Patched Stored XSS vulnerability in public share page via unsanitized share metadata
  • Patched password-protected share bypass vulnerability (CVE-2026-27611 incomplete remediation)
  • Added 'Divider' option in sidebar links for text or visual separation
  • Shares now include 'go to source location' sidebar link and edit button
  • Fixed database path loading to use FILEBROWSER_DATABASE env var by default

Breaking Changes

  • Global indexing rules have changed format when moving from 1.1.x to 1.2.x - see documentation for updated format

New Features

  • Added 'Divider' option in sidebar links to add text or dividers between links
  • Shares offer a 'go to source location' sidebar link and button when editing a share
  • OIDC group claims now accepted as map
  • Share edit/delete permissions scoped to user's shares rather than global

Full Release Notes

## What's Changed

> [!CAUTION]  
> **Breaking changes moving from 1.1.x to 1.2.x:**
>  - if you use global indexing rules, they have changed format -- see [docs](https://filebrowserquantum.com/en/docs/advanced/source-configuration/conditional-rules/)

 **Security**:
 - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse)
 - Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info GHSA-525j-95gf-766f

 **New Features**:
 - "Divider" option in sidebar links to add a text or divider between links (#1875)
 - shares offer a "go to source Location" sidebar link and button when editing a share.

 **Notes**:
 - Share edit/delete permissions are scoped to the user's shares rather than global (#2050)
 - OIDC group claims accepted as map (#2084)

 **BugFixes**:
 - fixed the requirement that the database path needed to be set in the config file, now it loads `FILEBROWSER_DATABASE` value by default, fallback to config file property.
 - Error downloading zipped directory: no such file or directory (users with scope) #2015

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.2.1-stable...v1.2.2-stable